FWSM and PIX 535 migration and differences

[jeff.vargas]

I'm migrating my PIX 535 config to a new FWSM and have come across some subtle differences. For instance, I have to apply a permit for ICMP to the interfaces and secondly all traffic does not seem to be allowed from inside to outside by default. Does anyone know of a document that outlines these differences?

Thanks,

[thomas.chen]

What is the version of software which you are using ?

[jeff.vargas]

Sorry for the late reply, I hope you read this. I'm on 2.3.4

[varakantam]

ICMP to the interfaces is disabled by default.

Unlike PIX, FWSM does not allow default flow of traffic. You need to explicitly define rules for the traffic to flow.

[Fernando_Meza]

Yes .. and also for getting ICMp to traverse the firewall module you need to enabled icmp inspection

fixup protocol icmp

fixup protocol icmp error

http://cisco.com/en/US/products/hw/switches/ps708/products_module_configuration_guide_book09186a00802c303c.html

more details can be found on the admin guide

I hope it helps .. please rate it it does !!!